# Assume different roles via the "sts assume-role" command in AWS CLI Steps

AWS provides the Security Token Service (STS) web service that enables you to request temporary, limited-privilege credentials for users. STS allows a single AWS Step integration instance to be used for multiple AWS accounts, reducing the number of integration instances that need to be created.

The most common way to use STS to request temporary, limited-privilege credentials in Workflows is via a generic **AWS CLI command** Step that runs an `aws sts assume-role` command.

1. **Set up an AWS Steps integration instance:** See the [guide](https://kb.torq.io/en/articles/9138309-amazon-web-services-aws#h_f0fbd8396e) on creating an AWS Steps integration instance.

2. **Open the Workflow:** In Torq, navigate to **Build > Workflows** and select the relevant Workflow.

3. **Add the Step:** Add the **AWS CLI command** Step to the Workflow.

4. **Edit the Step's parameters:**

  1. Enter the command `sts assume-role --role-arn <role ARN> --role-session-name "torq-assumed-session"` with the AWS role ARN you copied [earlier](https://kb.torq.io/en/articles/9138309-amazon-web-services-aws#h_ecd6f9cc39).

  2. Enter the role ARN again.

  3. Select the relevant AWS Steps integration instance with the correct permissions.

    ![](https://downloads.intercomcdn.com/i/o/eomhaz2o/1703839462/2c80ee024e5217f0282b720b5c2c/Screenshot+2025-07-27+at+21_53_41+copy.png?expires=1793573100&amp;signature=de7a64555e46f64014f9544a6e76ff0cfacea2fe17ad9f1be733230328158d61&amp;req=dScnFcF9lIVZW%2FMW1HO4zcjfmnPyn2PZL0YLxwdtapl09irBO2yx14CV74sw%0ALQyN%0A)

5. **Run the Step:** Click **Execute** on the Step or run the Workflow. The output will look similar to:
​

```
{
  "error": "",
  "exit_code": 0,
  "output": {
    "AssumedRoleUser": {
      "Arn": "arn:aws:sts::************:assumed-role/acita_torq_security_lake_custom_source/torq-assumed-session",
      "AssumedRoleId": "**********************:torq-assumed-session"
    },
    "Credentials": {
      "AccessKeyId": "A*********************V",
      "Expiration": "2023-03-17T17:20:21+00:00",
      "SecretAccessKey": "zc******************************dDh",
      "SessionToken": "Fwo*********************************************************************************************************************="
    }
  },
  "output_file": "",
  "step_status": {
    "code": 1,
    "message": "",
    "verbose": ""
  }
}
```

6. **Save the credentials:** Save `AccessKeyId` , `SecretAccessKey`, and `SessionToken` for later. They are the temporary credentials that can be used in other Steps such as **Run a Python script**.

![](https://downloads.intercomcdn.com/i/o/eomhaz2o/1668587213/8747d88d2e7d47d4589e900ee404/Screenshot+2025-08-13+at+7_57_58+copy+%281%29.png?expires=1793573100&amp;signature=7f4fd4010c6657dba0b69e3e41884b714043834b818bf71d30e0e6bf6407bbf9&amp;req=dSYhHsx2moNeWvMW1HO4zQW6AOkaKpyCAgBFu7CcyOHHYR4%2FnKnyMILIh7l7%0A1fviyMnE3PJN3ygM3QQ%3D%0A)